Pinned post
Upsun is rolling out patched PHP images after two critical vulnerabilities (CVSS v4.0 9.2, critical remote code execution vulnerabilities). If your app uses the PHP runtime image on PHP 7.4 or later, we redeploy it for you. No action needed.
We applied edge protection mitigation measures before the public release, and they protect every customer. Patched images are rolling out now. Expect a brief redeploy. Your code and configuration do not change.
On PHP 7.3 or earlier, or the composable image? You have a step to take.
Read the rollout details and what to check: developer.upsun.com/posts/releases…
And follow our status page for progress updates: status.upsun.com/incidents/2cdv…
We applied edge protection mitigation measures before the public release, and they protect every customer. Patched images are rolling out now. Expect a brief redeploy. Your code and configuration do not change.
On PHP 7.3 or earlier, or the composable image? You have a step to take.
Read the rollout details and what to check: developer.upsun.com/posts/releases…
And follow our status page for progress updates: status.upsun.com/incidents/2cdv…
developer.upsun.com Critical PHP security patches: Upsun rollout and what to check - Upsun Developer PHP fixed two critical vulnerabilities on October 21, 2026. See the patched versions, how Upsun Cloud is rolling them out, and what to check in your projects. 
